taskforce-loop-engineering 0.13.0 → 0.15.0

package/lib/execution-ledger.mjs

@@ -0,0 +1,41 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { mkdir, readFile, readdir, rename, rm, stat, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+
+export const EXECUTION_LEDGER_VERSION = 2;
+const KINDS = new Set(['llm', 'tool', 'effect']);
+const TERMINAL = new Set(['succeeded', 'failed', 'cancelled']);
+const SENSITIVE = /(^|_)(secret|token|password|credential|api[_-]?key|private[_-]?key)(_|$)/i;
+const canonicalValue = (value) => Array.isArray(value) ? value.map(canonicalValue) : value && typeof value === 'object' ? Object.fromEntries(Object.keys(value).sort().map((key) => [key, canonicalValue(value[key])])) : value;
+const hash = (value) => createHash('sha256').update(typeof value === 'string' ? value : JSON.stringify(canonicalValue(value))).digest('hex');
+export const stepInputFingerprint = (input) => hash(input);
+function text(value, name) { if (typeof value !== 'string' || !value.trim()) throw new Error(`${name} must be a non-empty string.`); return value; }
+function safeId(value, name = 'stepId') { text(value, name); if (!/^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,299}$/.test(value)) throw new Error(`${name} contains unsafe characters or is too long.`); return value; }
+function redact(value, key = '') { if (SENSITIVE.test(key)) return '[REDACTED]'; if (Array.isArray(value)) return value.map((item) => redact(item)); if (value && typeof value === 'object') return Object.fromEntries(Object.keys(value).sort().map((name) => [name, redact(value[name], name)])); return value; }
+function locations(root, stepId) { const directory = path.join(path.resolve(root), 'runtime', 'loops', 'execution-ledger'); const key = hash(safeId(stepId)); return { file: path.join(directory, 'steps', `${key}.json`), lock: path.join(directory, 'locks', key) }; }
+async function atomicWrite(file, value) { await mkdir(path.dirname(file), { recursive: true }); const temporary = `${file}.${process.pid}.${randomUUID()}.tmp`; await writeFile(temporary, `${JSON.stringify(value, null, 2)}\n`, { flag: 'wx', mode: 0o600 }); await rename(temporary, file); }
+async function mutex(lock) { await mkdir(path.dirname(lock), { recursive: true }); const deadline = Date.now() + 5000; while (true) { try { await mkdir(lock); return; } catch (error) { if (error.code !== 'EEXIST') throw error; const info = await stat(lock).catch(() => null); if (info && Date.now() - info.mtimeMs > 30_000) await rm(lock, { recursive: true, force: true }); else if (Date.now() >= deadline) throw new Error('Timed out acquiring execution ledger mutex.'); else await new Promise((resolve) => setTimeout(resolve, 10)); } } }
+async function mutate(root, stepId, operation) { const loc = locations(root, stepId); await mkdir(path.dirname(loc.file), { recursive: true }); await mutex(loc.lock); try { const record = await readFile(loc.file, 'utf8').then(JSON.parse).catch((error) => error.code === 'ENOENT' ? null : Promise.reject(error)); const result = await operation(record); if (result.write) await atomicWrite(loc.file, result.record); return result.output ?? result.record; } finally { await rm(loc.lock, { recursive: true, force: true }); } }
+function event(record, type, data = {}) { const entry = { sequence: record.events.length + 1, type, at: new Date().toISOString(), ...redact(data), previous: record.events.at(-1)?.checksum ?? null }; entry.checksum = hash(entry); return entry; }
+function assertFence(record, token) { if (record.status !== 'running' || record.lease?.fencing_token !== Number(token)) throw new Error('Stale or invalid fencing token.'); }
+
+export async function registerStep(root, input) {
+  const stepId = safeId(input.stepId); const kind = text(input.kind, 'kind'); if (!KINDS.has(kind)) throw new Error(`Unsupported step kind: ${kind}`); const fingerprint = stepInputFingerprint(input.input);
+  return mutate(root, stepId, async (record) => {
+    if (record) { if (record.kind !== kind || record.input_fingerprint !== fingerprint) throw new Error('Replay divergence: step identity is bound to a different kind or input fingerprint.'); return { write: false, output: { created: false, reusable: record.status === 'succeeded' && record.policy.reusable, record } }; }
+    const now = new Date().toISOString(); const created = { schema: 'loop.execution_step', version: 2, step_id: stepId, kind, status: 'pending', input_fingerprint: fingerprint, input: redact(input.input), lineage: { run_id: input.runId ?? null, task_id: input.taskId ?? null, parent_step_id: input.parentStepId ?? null, replaces_step_id: input.replacesStepId ?? null }, policy: { reusable: input.reusable !== false, effect_key: kind === 'effect' ? safeId(input.effectKey ?? stepId, 'effectKey') : null, authorization_scope: input.authorizationScope ?? null }, attempt: 0, fencing_counter: 0, lease: null, checkpoints: [], outcome: null, evidence: [], reconciliation: null, created_at: now, updated_at: now, events: [] }; created.events.push(event(created, 'registered', { input_fingerprint: fingerprint })); return { write: true, record: created, output: { created: true, reusable: false, record: created } };
+  });
+}
+export async function inspectStep(root, stepId) { const loc = locations(root, stepId); return readFile(loc.file, 'utf8').then(JSON.parse).catch((error) => error.code === 'ENOENT' ? null : Promise.reject(error)); }
+export async function claimStep(root, input) {
+  const leaseMs = Number(input.leaseMs ?? 60_000); if (!Number.isInteger(leaseMs) || leaseMs <= 0) throw new Error('leaseMs must be a positive integer.');
+  return mutate(root, input.stepId, async (record) => { if (!record) throw new Error('Step must be registered before claim.'); if (record.status === 'succeeded') return { write: false, output: { claimed: false, reason: record.policy.reusable ? 'reusable_outcome' : 'terminal', record } }; if (TERMINAL.has(record.status)) return { write: false, output: { claimed: false, reason: 'terminal', record } }; if (record.status === 'unknown') return { write: false, output: { claimed: false, reason: 'reconcile_required', record } }; const nowMs = Date.now(); if (record.status === 'running' && Date.parse(record.lease.expires_at) > nowMs) return { write: false, output: { claimed: false, reason: 'lease_active', record } }; if (record.status === 'running') { const at = new Date().toISOString(); const next = { ...record, status: 'unknown', lease: null, reconciliation: { required: true, reason: 'lease_expired_after_claim', at }, updated_at: at }; next.events = [...record.events, event(record, 'outcome_unknown', { reason: 'lease_expired_after_claim' })]; return { write: true, record: next, output: { claimed: false, reason: 'reconcile_required', record: next } }; } const token = record.fencing_counter + 1; const at = new Date().toISOString(); const next = { ...record, status: 'running', attempt: record.attempt + 1, fencing_counter: token, lease: { owner: text(input.owner, 'owner'), fencing_token: token, claimed_at: at, expires_at: new Date(nowMs + leaseMs).toISOString() }, updated_at: at }; next.events = [...record.events, event(record, 'claimed', { attempt: next.attempt, fencing_token: token, owner: input.owner })]; return { write: true, record: next, output: { claimed: true, fencingToken: token, attempt: next.attempt, record: next } }; });
+}
+export async function checkpointStep(root, input) { return mutate(root, input.stepId, async (record) => { assertFence(record, input.fencingToken); const checkpoint = { sequence: record.checkpoints.length + 1, at: new Date().toISOString(), fingerprint: stepInputFingerprint(input.state), state: redact(input.state), evidence: redact(input.evidence ?? null) }; const next = { ...record, checkpoints: [...record.checkpoints, checkpoint], updated_at: checkpoint.at }; next.events = [...record.events, event(record, 'checkpointed', { sequence: checkpoint.sequence, fingerprint: checkpoint.fingerprint })]; return { write: true, record: next, output: checkpoint }; }); }
+export async function completeStep(root, input) { return mutate(root, input.stepId, async (record) => { if (record?.status === 'succeeded') return { write: false, output: { completed: false, duplicate: true, record } }; assertFence(record, input.fencingToken); const at = new Date().toISOString(); const outcome = { status: 'succeeded', output_fingerprint: stepInputFingerprint(input.output), output: redact(input.output), at }; const next = { ...record, status: 'succeeded', lease: null, outcome, evidence: [...record.evidence, redact(input.evidence ?? {})], reconciliation: null, updated_at: at }; next.events = [...record.events, event(record, 'succeeded', { output_fingerprint: outcome.output_fingerprint })]; return { write: true, record: next, output: { completed: true, duplicate: false, record: next } }; }); }
+export async function markStepUnknown(root, input) { return mutate(root, input.stepId, async (record) => { assertFence(record, input.fencingToken); const at = new Date().toISOString(); const next = { ...record, status: 'unknown', lease: null, reconciliation: { required: true, reason: input.reason ?? 'submit_outcome_unknown', at }, evidence: [...record.evidence, redact(input.evidence ?? {})], updated_at: at }; next.events = [...record.events, event(record, 'outcome_unknown', { reason: next.reconciliation.reason })]; return { write: true, record: next }; }); }
+export async function reconcileStep(root, input) { return mutate(root, input.stepId, async (record) => { if (!record || record.status !== 'unknown') throw new Error('Only an unknown step can be reconciled.'); if (!['accepted', 'not_accepted'].includes(input.outcome)) throw new Error('Reconciliation outcome must be accepted or not_accepted.'); if (!input.evidence) throw new Error('Reconciliation requires evidence.'); const at = new Date().toISOString(); const evidence = redact(input.evidence); if (input.outcome === 'accepted') { const outcome = { status: 'succeeded', output_fingerprint: stepInputFingerprint(input.output), output: redact(input.output), reconciled: true, at }; const next = { ...record, status: 'succeeded', outcome, evidence: [...record.evidence, evidence], reconciliation: { required: false, outcome: 'accepted', at }, updated_at: at }; next.events = [...record.events, event(record, 'reconciled_accepted', { output_fingerprint: outcome.output_fingerprint })]; return { write: true, record: next }; } const next = { ...record, status: 'pending', lease: null, evidence: [...record.evidence, evidence], reconciliation: { required: false, outcome: 'not_accepted', at }, updated_at: at }; next.events = [...record.events, event(record, 'reconciled_not_accepted')]; return { write: true, record: next }; }); }
+export async function replayDecision(root, input) { const record = await inspectStep(root, input.stepId); if (!record) return { action: 'register_and_execute', record: null }; if (record.kind !== input.kind || record.input_fingerprint !== stepInputFingerprint(input.input)) return { action: 'divergence', reason: 'input_fingerprint_mismatch', record }; if (record.status === 'succeeded' && record.policy.reusable) return { action: 'reuse', output: record.outcome.output, evidence: record.evidence, record }; if (record.status === 'unknown' || record.status === 'running') return { action: 'reconcile', record }; if (record.status === 'pending') return { action: 'execute', checkpoint: record.checkpoints.at(-1) ?? null, record }; return { action: 'terminal', record }; }
+export async function listSteps(root) { const dir = path.join(path.resolve(root), 'runtime', 'loops', 'execution-ledger', 'steps'); const result = []; for (const name of (await readdir(dir).catch(() => [])).filter((name) => name.endsWith('.json')).sort()) result.push(JSON.parse(await readFile(path.join(dir, name), 'utf8'))); return result.sort((a, b) => a.step_id.localeCompare(b.step_id)); }
+export async function migrateLegacyJournalStep(root, legacy) { return registerStep(root, { stepId: legacy.step_id ?? legacy.stepId ?? `legacy:${legacy.transactionId ?? hash(legacy).slice(0, 24)}`, kind: KINDS.has(legacy.kind) ? legacy.kind : 'tool', input: legacy.input ?? legacy.payload ?? legacy, taskId: legacy.task_id, runId: legacy.run_id, reusable: legacy.reusable !== false }); }
+export async function migrateActionReservation(root, reservation) { const registered = await registerStep(root, { stepId: `effect:${reservation.idempotency_key}`, kind: 'effect', effectKey: reservation.idempotency_key, input: reservation.request, authorizationScope: reservation.authorization?.scope, reusable: true }); return { ...registered, legacy_state: reservation.state, migration: 'action_reservation_to_effect_protocol_v2' }; }

package/lib/operator-dashboard.mjs

@@ -102,9 +102,23 @@ async function actions(root, warnings, nowMs) {
   return result.sort((a, b) => String(a.idempotency_key).localeCompare(String(b.idempotency_key)));
 }
 
+async function executionSteps(root, warnings, nowMs) {
+  const result = [];
+  for (const file of await files(path.join(root, 'runtime', 'loops', 'execution-ledger', 'steps'))) {
+    const item = await json(file, warnings, root); if (!item) continue;
+    result.push(clean({ step_id: item.step_id, kind: item.kind, state: normalizedState(item, null, nowMs), status: item.status, input_fingerprint: item.input_fingerprint, attempt: item.attempt, lineage: item.lineage, lease: item.lease, checkpoint_count: item.checkpoints?.length ?? 0, outcome: item.outcome, evidence: item.evidence, reconciliation: item.reconciliation, updated_at: item.updated_at }));
+  }
+  return result.sort((a, b) => a.step_id.localeCompare(b.step_id));
+}
+
+async function productionEvidence(root, warnings) {
+  const file = path.join(root, '.production-evidence', 'public-summary.json');
+  try { return clean(await json(file, warnings, root)); } catch { return null; }
+}
+
 async function legacyQueues(root, warnings, nowMs) {
   const loops = path.join(root, 'runtime', 'loops');
-  const excluded = new Set(['control-plane', 'action-reservations', 'projects']);
+  const excluded = new Set(['control-plane', 'action-reservations', 'execution-ledger', 'projects']);
   const queues = [];
   for (const name of (await dirs(loops)).filter((item) => !excluded.has(item))) {
     const base = path.join(loops, name); const counts = Object.fromEntries([...STATES].map((state) => [state, 0])); const tasks = [];
@@ -138,13 +152,13 @@ export async function buildOperatorProjection(root, options = {}) {
   const resolved = path.resolve(root); const now = options.now ? new Date(options.now) : new Date();
   if (Number.isNaN(now.getTime())) throw new Error('Invalid projection time.');
   const warnings = []; const before = await stat(path.join(resolved, 'runtime', 'loops')).catch(() => null);
-  const [control, reservations, queueList, projectList] = await Promise.all([controlPlane(resolved, warnings, now.getTime()), actions(resolved, warnings, now.getTime()), legacyQueues(resolved, warnings, now.getTime()), projects(resolved, warnings)]);
-  const newest = [control.updated_at, ...control.todos.map((item) => item.updated_at), ...reservations.map((item) => item.updated_at), ...queueList.flatMap((queue) => queue.tasks.map((item) => item.updated_at))].filter(Boolean).sort().at(-1) ?? null;
+  const [control, reservations, steps, queueList, projectList, trustEvidence] = await Promise.all([controlPlane(resolved, warnings, now.getTime()), actions(resolved, warnings, now.getTime()), executionSteps(resolved, warnings, now.getTime()), legacyQueues(resolved, warnings, now.getTime()), projects(resolved, warnings), productionEvidence(resolved, warnings)]);
+  const newest = [control.updated_at, ...control.todos.map((item) => item.updated_at), ...reservations.map((item) => item.updated_at), ...steps.map((item) => item.updated_at), ...queueList.flatMap((queue) => queue.tasks.map((item) => item.updated_at))].filter(Boolean).sort().at(-1) ?? null;
   const counts = Object.fromEntries([...STATES].map((state) => [state, 0]));
   for (const item of [...control.todos, ...queueList.flatMap((queue) => queue.tasks)]) counts[item.state] += 1;
   const after = await stat(path.join(resolved, 'runtime', 'loops')).catch(() => null);
   if (before && after && before.mtimeMs !== after.mtimeMs) warnings.push({ code: 'concurrent_update', artifact: 'runtime/loops', message: 'Artifacts changed while the projection was read; refresh recommended.' });
-  return clean({ schema_version: DASHBOARD_SCHEMA_VERSION, generated_at: now.toISOString(), source: { root: resolved, read_only: true, newest_artifact_at: newest, freshness_seconds: newest ? Math.max(0, Math.floor((now.getTime() - Date.parse(newest)) / 1000)) : null }, health: { status: warnings.length ? 'degraded' : 'ok', warnings }, overview: { counts, queue_count: queueList.length, project_count: projectList.length, todo_count: control.todos.length, action_count: reservations.length }, projects: projectList, queues: queueList, todos: control.todos, agents: control.agents, handoffs: control.handoffs, gates: control.todos.filter((item) => ['parked', 'waiting_for_human', 'waiting_for_external_condition', 'timed_out_or_escalated'].includes(item.state)).map((item) => ({ todo_id: item.id, state: item.state, gate: item.gate, next_action: item.next_action })), actions: reservations, cost: { quotas: control.quotas, requested_total: control.todos.reduce((sum, item) => sum + Number(item.cost?.amount ?? 0), 0) } });
+  return clean({ schema_version: DASHBOARD_SCHEMA_VERSION, generated_at: now.toISOString(), source: { root: resolved, read_only: true, newest_artifact_at: newest, freshness_seconds: newest ? Math.max(0, Math.floor((now.getTime() - Date.parse(newest)) / 1000)) : null }, health: { status: warnings.length ? 'degraded' : 'ok', warnings }, overview: { counts, queue_count: queueList.length, project_count: projectList.length, todo_count: control.todos.length, action_count: reservations.length, step_count: steps.length, reconciliation_required_steps: steps.filter((item) => item.state === 'reconciliation_required').length, production_trust: trustEvidence?.passed ? 'passed' : trustEvidence ? 'failed' : 'not_generated' }, projects: projectList, queues: queueList, todos: control.todos, agents: control.agents, handoffs: control.handoffs, gates: control.todos.filter((item) => ['parked', 'waiting_for_human', 'waiting_for_external_condition', 'timed_out_or_escalated'].includes(item.state)).map((item) => ({ todo_id: item.id, state: item.state, gate: item.gate, next_action: item.next_action })), actions: reservations, execution_steps: steps, production_evidence: trustEvidence, cost: { quotas: control.quotas, requested_total: control.todos.reduce((sum, item) => sum + Number(item.cost?.amount ?? 0), 0) } });
 }
 
 export function filterProjection(projection, options = {}) {

package/lib/production-evidence.mjs

@@ -0,0 +1,54 @@
+import { createHash } from 'node:crypto';
+import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+
+export const PRODUCTION_EVIDENCE_VERSION = 1;
+const SECRET = /(^|_)(secret|token|password|credential|api[_-]?key|private[_-]?key)(_|$)/i;
+const canonical = (value) => Array.isArray(value) ? value.map(canonical) : value && typeof value === 'object' ? Object.fromEntries(Object.keys(value).sort().map((key) => [key, canonical(value[key])])) : value;
+const digest = (value) => createHash('sha256').update(JSON.stringify(canonical(value))).digest('hex');
+export const redactEvidence = (value, key = '') => SECRET.test(key) ? '[REDACTED]' : Array.isArray(value) ? value.map((item) => redactEvidence(item)) : value && typeof value === 'object' ? Object.fromEntries(Object.entries(value).map(([name, item]) => [name, redactEvidence(item, name)])) : value;
+export const evidenceDigest = (value) => digest(value);
+
+export function evaluateEvidence(report, baseline = null) {
+  const thresholds = report.thresholds ?? {};
+  const metrics = report.metrics ?? {};
+  const checks = Object.entries(thresholds).map(([metric, rule]) => {
+    const actual = Number(metrics[metric]);
+    const passed = Number.isFinite(actual) && (rule.max === undefined || actual <= rule.max) && (rule.min === undefined || actual >= rule.min);
+    return { metric, actual, ...rule, passed, attribution: passed ? null : rule.attribution ?? 'unattributed_threshold_failure' };
+  });
+  const previous = baseline?.metrics ?? {};
+  const trend = Object.fromEntries(Object.keys(metrics).sort().filter((key) => Number.isFinite(Number(metrics[key])) && Number.isFinite(Number(previous[key]))).map((key) => [key, { baseline: Number(previous[key]), current: Number(metrics[key]), delta: Number(metrics[key]) - Number(previous[key]) }]));
+  return { checks, trend, passed: checks.every((item) => item.passed) && report.scenarios.every((item) => item.status === 'passed') && report.compatibility.every((item) => item.status === 'passed') };
+}
+
+export function sealEvidence(input) {
+  const report = redactEvidence({ ...input, schema: 'loop.production_trust_evidence', schema_version: PRODUCTION_EVIDENCE_VERSION });
+  const unsigned = { ...report, integrity: undefined };
+  delete unsigned.integrity;
+  return { ...report, integrity: { algorithm: 'sha256', digest: digest(unsigned) } };
+}
+
+export function verifyEvidence(report) {
+  if (report?.schema !== 'loop.production_trust_evidence' || report.schema_version !== PRODUCTION_EVIDENCE_VERSION) return { valid: false, reason: 'unsupported_schema' };
+  const unsigned = { ...report }; delete unsigned.integrity;
+  const actual = digest(unsigned); const expected = report.integrity?.digest;
+  return { valid: actual === expected, reason: actual === expected ? null : 'digest_mismatch', expected, actual };
+}
+
+export function publicEvidenceSummary(report) {
+  const verification = verifyEvidence(report);
+  return redactEvidence({ schema: 'loop.production_trust_public_summary', schema_version: 1, evidence_digest: report.integrity?.digest, generated_at: report.generated_at, passed: report.passed && verification.valid, fixtures: report.compatibility.map(({ runtime, contract_version, status }) => ({ runtime, contract_version, status })), metrics: report.metrics, thresholds: report.thresholds, failures: report.evaluation.checks.filter((item) => !item.passed).map(({ metric, attribution }) => ({ metric, attribution })), limitations: report.limitations });
+}
+
+export async function writeEvidenceBundle(directory, report) {
+  const sealed = sealEvidence(report); const summary = publicEvidenceSummary(sealed);
+  await mkdir(directory, { recursive: true });
+  for (const [name, value] of [['evidence.json', sealed], ['public-summary.json', summary]]) {
+    const file = path.join(directory, name); const temporary = `${file}.${process.pid}.tmp`;
+    await writeFile(temporary, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 }); await rename(temporary, file);
+  }
+  return { report: sealed, summary };
+}
+
+export async function readAndVerifyEvidence(file) { const report = JSON.parse(await readFile(file, 'utf8')); return { report, verification: verifyEvidence(report) }; }

package/lib/runtime-adapter-sdk.mjs

@@ -0,0 +1,115 @@
+import { createHash, randomUUID } from 'node:crypto';
+
+export const RUNTIME_ADAPTER_CONTRACT = 'loop.runtime-adapter';
+export const RUNTIME_ADAPTER_VERSION = '1.0.0';
+export const RUNTIME_ADAPTER_MAJOR = 1;
+export const RUNTIMES = Object.freeze(['openclaw', 'hermes', 'codex-cli', 'claude-code']);
+export const EFFECT_STATES = Object.freeze(['prepared', 'authorized', 'submitted', 'settled', 'unknown', 'rejected']);
+
+export class AdapterError extends Error {
+  constructor(code, message, { retryable = false, cause, details } = {}) {
+    super(message, { cause });
+    this.name = 'AdapterError'; this.code = code; this.retryable = retryable;
+    this.details = redact(details ?? null);
+  }
+  toJSON() { return { name: this.name, code: this.code, message: this.message, retryable: this.retryable, details: this.details }; }
+}
+
+export function redact(value) {
+  if (Array.isArray(value)) return value.map(redact);
+  if (!value || typeof value !== 'object') return value;
+  return Object.fromEntries(Object.entries(value).map(([key, item]) =>
+    /token|secret|password|credential|authorization|cookie|api[-_]?key/i.test(key)
+      ? [key, '[REDACTED]'] : [key, redact(item)]));
+}
+
+const required = (value, label) => {
+  if (typeof value !== 'string' || !value.trim()) throw new AdapterError('INVALID_INPUT', `${label} is required`);
+  return value.trim();
+};
+const stableId = (prefix, value) => `${prefix}_${createHash('sha256').update(JSON.stringify(value)).digest('hex').slice(0, 20)}`;
+
+export function validateAdapter(adapter) {
+  if (adapter?.contract !== RUNTIME_ADAPTER_CONTRACT) throw new AdapterError('UNSUPPORTED_CONTRACT', 'unsupported adapter contract');
+  const major = Number.parseInt(String(adapter.version).split('.')[0], 10);
+  if (major !== RUNTIME_ADAPTER_MAJOR) throw new AdapterError('UNSUPPORTED_VERSION', `unsupported adapter version: ${adapter?.version}`);
+  if (!RUNTIMES.includes(adapter.runtime)) throw new AdapterError('UNSUPPORTED_RUNTIME', `unsupported runtime: ${adapter?.runtime}`);
+  for (const method of ['createSession', 'startRun', 'recordStep', 'prepareEffect', 'resolveGate', 'heartbeat', 'continueRun']) {
+    if (typeof adapter[method] !== 'function') throw new AdapterError('INVALID_ADAPTER', `adapter.${method} must be a function`);
+  }
+  return adapter;
+}
+
+export function defineRuntimeAdapter({ runtime, capabilities = [], transport }) {
+  if (!transport || typeof transport.invoke !== 'function') throw new AdapterError('INVALID_ADAPTER', 'transport.invoke must be a function');
+  const events = [];
+  const emit = (type, payload) => {
+    const event = redact({ contract: 'loop.telemetry', version: 1, type, runtime, at: new Date().toISOString(), ...payload });
+    events.push(event); transport.telemetry?.(event); return event;
+  };
+  const invoke = async (operation, payload) => {
+    try { return redact(await transport.invoke(operation, redact(payload))); }
+    catch (cause) {
+      if (cause instanceof AdapterError) throw cause;
+      throw new AdapterError('TRANSPORT_FAILURE', `${runtime} ${operation} failed`, { retryable: true, cause });
+    }
+  };
+  const adapter = {
+    contract: RUNTIME_ADAPTER_CONTRACT, version: RUNTIME_ADAPTER_VERSION, runtime,
+    capabilities: Object.freeze([...new Set(capabilities)].sort()),
+    telemetry: events,
+    async createSession(input = {}) {
+      const sessionId = input.sessionId ?? stableId('ses', { runtime, key: required(input.key, 'session key') });
+      const out = { sessionId, runtime, metadata: redact(input.metadata ?? {}) }; emit('session.created', out); return out;
+    },
+    async startRun(input = {}) {
+      const sessionId = required(input.sessionId, 'sessionId');
+      const runId = input.runId ?? stableId('run', { sessionId, requestId: input.requestId ?? randomUUID() });
+      const result = await invoke('run.start', { sessionId, runId, input: input.input ?? null });
+      const out = { sessionId, runId, status: result?.status ?? 'running' }; emit('run.started', out); return out;
+    },
+    async recordStep(input = {}) {
+      const runId = required(input.runId, 'runId'); const stepId = required(input.stepId, 'stepId');
+      const state = input.state ?? 'completed';
+      if (!['pending', 'running', 'completed', 'failed', 'waiting'].includes(state)) throw new AdapterError('INVALID_STEP_STATE', `invalid step state: ${state}`);
+      const evidence = redact(input.evidence ?? []); emit('step.recorded', { runId, stepId, state, evidence }); return { runId, stepId, state, evidence };
+    },
+    async prepareEffect(input = {}) {
+      const runId = required(input.runId, 'runId'); const effectId = required(input.effectId, 'effectId');
+      if (!input.idempotencyKey) throw new AdapterError('EFFECT_KEY_REQUIRED', 'effect idempotencyKey is required');
+      if (input.authorized !== true) throw new AdapterError('EFFECT_NOT_AUTHORIZED', 'effect is fail-closed until explicitly authorized');
+      const out = { runId, effectId, idempotencyKey: input.idempotencyKey, state: 'authorized', payload: redact(input.payload ?? null) };
+      emit('effect.authorized', out); return out;
+    },
+    async resolveGate(input = {}) {
+      const gateId = required(input.gateId, 'gateId');
+      if (!['approved', 'rejected'].includes(input.decision)) throw new AdapterError('INVALID_GATE_DECISION', 'gate decision must be approved or rejected');
+      const out = { gateId, decision: input.decision, responseRef: input.responseRef ?? null }; emit('gate.resolved', out); return out;
+    },
+    async heartbeat(input = {}) {
+      const runId = required(input.runId, 'runId'); const result = await invoke('run.heartbeat', { runId });
+      const out = { runId, alive: result?.alive !== false, continuationToken: result?.continuationToken ?? null };
+      emit('run.heartbeat', out); return out;
+    },
+    async continueRun(input = {}) {
+      const runId = required(input.runId, 'runId'); const continuationToken = required(input.continuationToken, 'continuationToken');
+      const result = await invoke('run.continue', { runId, continuationToken });
+      const out = { runId, status: result?.status ?? 'running' }; emit('run.continued', out); return out;
+    }
+  };
+  return validateAdapter(adapter);
+}
+
+export function createMemoryTransport() {
+  const calls = [];
+  return { calls, async invoke(operation, payload) {
+    calls.push({ operation, payload });
+    if (operation === 'run.heartbeat') return { alive: true, continuationToken: `continue_${payload.runId}` };
+    return { status: 'running' };
+  } };
+}
+
+export const createOpenClawAdapter = (transport) => defineRuntimeAdapter({ runtime: 'openclaw', capabilities: ['sessions', 'effects', 'human-gates', 'continuation'], transport });
+export const createHermesAdapter = (transport) => defineRuntimeAdapter({ runtime: 'hermes', capabilities: ['sessions', 'effects', 'human-gates', 'continuation'], transport });
+export const createCodexCliAdapter = (transport) => defineRuntimeAdapter({ runtime: 'codex-cli', capabilities: ['sessions', 'effects', 'human-gates', 'continuation'], transport });
+export const createClaudeCodeAdapter = (transport) => defineRuntimeAdapter({ runtime: 'claude-code', capabilities: ['sessions', 'effects', 'human-gates', 'continuation'], transport });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "taskforce-loop-engineering",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "private": false,
   "description": "OpenClaw-native loop engineering CLI, templates, and skill for verifiable agent work loops.",
   "type": "module",
@@ -17,10 +17,13 @@
     "run-loop-cron.sh": "scripts/run-loop-cron.sh"
   },
   "scripts": {
-    "check:production-trust": "node --check lib/runtime-adapter-v1.mjs && node --check lib/durable-journal.mjs && node --check lib/upgrade-planner.mjs && node scripts/production-acceptance.mjs",
+    "check:adapters": "node --check lib/runtime-adapter-sdk.mjs && node scripts/runtime-adapter-conformance.mjs",
+    "demo:adapter": "node examples/adapter-sdk-demo.mjs",
+    "check:production-trust": "node --check lib/runtime-adapter-v1.mjs && node --check lib/durable-journal.mjs && node --check lib/execution-ledger.mjs && node --check lib/production-evidence.mjs && node --check lib/upgrade-planner.mjs && node scripts/production-acceptance.mjs",
     "check:config-drift": "node --check scripts/config-drift-self-test.mjs && node scripts/config-drift-self-test.mjs",
     "check:openclaw-install": "node --check scripts/openclaw-install.mjs && node --check scripts/openclaw-doctor.mjs && node --check scripts/openclaw-smoke.mjs && node --check scripts/openclaw-manage.mjs && node scripts/openclaw-install-self-test.mjs",
     "check:hermes-install": "node --check scripts/hermes-install.mjs && node --check scripts/hermes-doctor.mjs && node --check scripts/hermes-smoke.mjs && node scripts/hermes-install-self-test.mjs",
+    "check:project-gates": "node --check lib/core.mjs && node scripts/project-gate-reconciliation-self-test.mjs",
     "check": "npm run check:config-drift && npm run check:openclaw-install && npm run check:hermes-install && node --check bin/loop-engineering.mjs && node --check lib/core.mjs && node --check lib/action-reservations.mjs && node --check lib/todo-control-plane.mjs && node --check lib/operator-dashboard.mjs && node scripts/action-reservation-self-test.mjs && node scripts/todo-control-plane-self-test.mjs && node scripts/operator-dashboard-self-test.mjs && node scripts/final-judgement-self-test.mjs && node scripts/route-notify-self-test.mjs && node scripts/scheduler-heartbeat-self-test.mjs && node scripts/human-gate-lifecycle-v2-self-test.mjs && node bin/loop-engineering.mjs verify --config templates/workspace-health.json --root . && node bin/loop-engineering.mjs queue-status --queue smoke --root . --json >/dev/null && node bin/loop-engineering.mjs project-intake --root /tmp/loop-engineering-check --name smoke-project --brief \"Build a small website project\" --type auto --check \"npm test\" --json >/dev/null && node bin/loop-engineering.mjs project-plan --root /tmp/loop-engineering-check --project smoke-project --force --json >/dev/null && node bin/loop-engineering.mjs project-status --root /tmp/loop-engineering-check --project smoke-project --json >/dev/null && node bin/loop-engineering.mjs queue-scheduler-tick --queue smoke --root /tmp/loop-engineering-check --plan-only --force-due --json >/dev/null && node bin/loop-engineering.mjs queue-scheduler-tick --queue smoke-progress --root /tmp/loop-engineering-check --plan-only --force-due --progress-report --progress-report-when-not-due --json >/dev/null && node bin/loop-engineering.mjs workflow-metrics --queue smoke --root . --json >/dev/null && node bin/loop-engineering.mjs workflow-tune-plan --queue smoke --root . --json >/dev/null && node bin/loop-engineering.mjs code-queue-init --queue smoke-code --root /tmp/loop-engineering-check --force >/dev/null && node bin/loop-engineering.mjs code-worktree-list --queue smoke-code --root /tmp/loop-engineering-check --json >/dev/null && node bin/loop-engineering.mjs code-task-status --queue smoke-code --root /tmp/loop-engineering-check --json >/dev/null && node bin/loop-engineering.mjs code-task-dashboard --queue smoke-code --root /tmp/loop-engineering-check --json >/dev/null && node bin/loop-engineering.mjs code-worktree-cleanup-plan --queue smoke-code --root /tmp/loop-engineering-check --json >/dev/null && node bin/loop-engineering.mjs code-worktree-cleanup --queue smoke-code --root /tmp/loop-engineering-check --confirm-cleanup --json >/dev/null && node bin/loop-engineering.mjs code-patch-verify --patch README.md --root . --json >/dev/null && node bin/loop-engineering.mjs code-patch-apply-plan --patch README.md --json >/dev/null && node bin/loop-engineering.mjs queue-revision-ci-self-test --queue smoke-ci --root /tmp/loop-engineering-check --json >/dev/null && node bin/loop-engineering.mjs summarize --root . --json >/dev/null && node bin/loop-engineering.mjs dashboard-health --root . --max-age-seconds 999999999 --json >/dev/null && node bin/loop-engineering.mjs doctor --root . --json >/dev/null",
     "pack:dry": "npm pack --dry-run"
   },
@@ -33,6 +36,7 @@
     "README.md",
     "bin/",
     "docs/",
+    "examples/",
     "lib/",
     "scripts/",
     "templates/",

package/scripts/execution-ledger-self-test.mjs

@@ -0,0 +1,10 @@
+import assert from 'node:assert/strict';
+import { mkdtemp } from 'node:fs/promises'; import { tmpdir } from 'node:os'; import path from 'node:path';
+import { checkpointStep, claimStep, completeStep, inspectStep, listSteps, markStepUnknown, migrateActionReservation, reconcileStep, registerStep, replayDecision, stepInputFingerprint } from '../lib/execution-ledger.mjs';
+const root = await mkdtemp(path.join(tmpdir(), 'loop-ledger-')); const base = { stepId: 'run:1:llm:plan', kind: 'llm', input: { model: 'mock', prompt: 'plan', api_key: 'secret' }, runId: 'run:1', taskId: 'task:1' };
+assert.equal((await registerStep(root, base)).created, true); assert.equal((await registerStep(root, base)).created, false); await assert.rejects(() => registerStep(root, { ...base, input: { prompt: 'changed' } }), /Replay divergence/); assert.equal((await inspectStep(root, base.stepId)).input.api_key, '[REDACTED]');
+const claims = await Promise.all(Array.from({ length: 16 }, (_, i) => claimStep(root, { stepId: base.stepId, owner: `w${i}`, leaseMs: 1000 }))); assert.equal(claims.filter((item) => item.claimed).length, 1); const winner = claims.find((item) => item.claimed); await checkpointStep(root, { stepId: base.stepId, fencingToken: winner.fencingToken, state: { cursor: 7 } }); await assert.rejects(() => completeStep(root, { stepId: base.stepId, fencingToken: winner.fencingToken + 1, output: 'bad' }), /fencing token/); await completeStep(root, { stepId: base.stepId, fencingToken: winner.fencingToken, output: { answer: 42 }, evidence: { fixture: 'mock' } }); assert.equal((await replayDecision(root, base)).action, 'reuse');
+await registerStep(root, { stepId: 'tool:crash-before', kind: 'tool', input: { command: 'mock' } }); await claimStep(root, { stepId: 'tool:crash-before', owner: 'dead', leaseMs: 1 }); await new Promise((resolve) => setTimeout(resolve, 5)); assert.equal((await claimStep(root, { stepId: 'tool:crash-before', owner: 'recover' })).reason, 'reconcile_required'); await reconcileStep(root, { stepId: 'tool:crash-before', outcome: 'not_accepted', evidence: { local: 'adapter_not_called' } }); assert.equal((await claimStep(root, { stepId: 'tool:crash-before', owner: 'recover' })).claimed, true);
+await registerStep(root, { stepId: 'effect:charge:1', kind: 'effect', effectKey: 'charge:1', input: { cents: 4 }, authorizationScope: 'test' }); const effect = await claimStep(root, { stepId: 'effect:charge:1', owner: 'worker' }); await markStepUnknown(root, { stepId: 'effect:charge:1', fencingToken: effect.fencingToken, reason: 'accepted_before_local_settle' }); assert.equal((await replayDecision(root, { stepId: 'effect:charge:1', kind: 'effect', input: { cents: 4 } })).action, 'reconcile'); await reconcileStep(root, { stepId: 'effect:charge:1', outcome: 'accepted', output: { upstream_id: 'mock-1' }, evidence: { upstream_lookup: 'mock-1' } }); assert.equal((await claimStep(root, { stepId: 'effect:charge:1', owner: 'retry' })).reason, 'reusable_outcome');
+const migrated = await migrateActionReservation(root, { idempotency_key: 'legacy:notify:1', state: 'reserved', request: { body: 'hello' }, authorization: { scope: 'chat' } }); assert.equal(migrated.record.policy.effect_key, 'legacy:notify:1'); assert.equal((await listSteps(root)).length, 4); assert.equal(stepInputFingerprint({ b: 2, a: 1 }), stepInputFingerprint({ a: 1, b: 2 }));
+console.log(JSON.stringify({ status: 'ok', assertions: ['identity', 'divergence', 'redaction', 'claim', 'lease', 'fencing', 'checkpoint', 'reuse', 'reconciliation', 'effect migration'] }));

package/scripts/final-judgement-self-test.mjs

@@ -1,9 +1,15 @@
 import assert from 'node:assert/strict';
-import { buildFinalJudgement, dispatchFailureClassification, selectEffectiveAcceptanceReviews } from '../lib/core.mjs';
+import { buildFinalJudgement, dispatchFailureClassification, inferTaskScope, selectEffectiveAcceptanceReviews } from '../lib/core.mjs';
 
 const basePlan = { rubric: [], automation: [] };
 const baseContract = { task_id: 't1', risk_level: 'L1', requires_human_gate: false, task_scope: 'scoped_task' };
 
+assert.equal(inferTaskScope({ body: '开发完整项目并完成整体目标' }), 'project');
+assert.equal(inferTaskScope({ body: '继续同一整体项目，仅推进 T-01 第 2 项；阶段完成后不能称整体项目完成' }), 'scoped_task');
+assert.equal(inferTaskScope({ body: 'Continue the project, only complete boundary item 2' }), 'scoped_task');
+assert.equal(inferTaskScope({ body: '继续同一整体项目，取消团队功能并从项目完成门槛中移除，其他 backlog 不变' }), 'scoped_task');
+assert.equal(inferTaskScope({ body: 'Continue the overall project with a product-scope amendment: remove the team feature from the completion gate.' }), 'scoped_task');
+
 {
   const devPlan = { checkpoints: [{ id: 'cp1' }] };
   const reviews = {
@@ -96,6 +102,19 @@ const baseContract = { task_id: 't1', risk_level: 'L1', requires_human_gate: fal
   assert.equal(judgement.outcome, 'project_in_progress');
 }
 
+{
+  const devPlan = { checkpoints: [{ id: 'cp1' }] };
+  const reviews = { reviews: [{
+    checkpointId: 'cp1', sequence: 1, status: 'accepted',
+    projectCompletion: { status: 'in_progress' },
+    deferredGates: [{ id: 'deploy', required_authority: 'owner deployment approval' }]
+  }] };
+  const judgement = buildFinalJudgement(baseContract, basePlan, devPlan, { count: 1 }, reviews, { dispatchStatus: 'completed' });
+  assert.equal(judgement.outcome, 'project_in_progress');
+  assert.equal(judgement.coverage.deferred_gates, 1);
+  assert.match(judgement.reasons.join(' '), /structured|waiting gates/);
+}
+
 {
   const devPlan = { checkpoints: [{ id: 'cp1' }] };
   const reviews = { reviews: [{ checkpointId: 'cp6', sequence: 6, status: 'accepted', projectCompletion: { status: 'accepted' } }] };

package/scripts/live-runtime-soak.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { spawn } from 'node:child_process';
-import { mkdir, rm, writeFile } from 'node:fs/promises';
+import { mkdir, rm, writeFile, rename } from 'node:fs/promises';
 import path from 'node:path';
 import { tmpdir } from 'node:os';
 import { randomUUID } from 'node:crypto';
@@ -23,6 +23,13 @@ const workDir = path.join(tmpdir(), `loop-live-soak-${runId}`);
 await mkdir(workDir, { recursive: true }); await mkdir(path.dirname(output), { recursive: true });
 const startedAt = new Date(); const deadline = startedAt.getTime() + durationMs;
 const report = { version: 1, kind: hermesBin ? 'live-openclaw-hermes-multi-agent-runtime-soak' : 'live-openclaw-multi-session-soak', runId, dryRun, runtimeOnly, startedAt: startedAt.toISOString(), deadlineAt: new Date(deadline).toISOString(), agent, sessions: 3, modelCallsCap: dryRun || runtimeOnly ? 0 : maxCalls, modelCallsAttempted: 0, consecutiveRuntimeErrors: 0, stoppedByCircuitBreaker: false, externalWrites: false, productionProcessesControlled: false, events: [], metrics: { runtimeProbeFailures: 0, heartbeats: 0, claims: 0, handoffs: 0, injectedCrashes: 0, restarts: 0, staleFencesAccepted: 0, duplicateEffects: 0, unknownReconciled: 0 } };
+const statusOutput = `${output}.status.json`;
+const writeStatus = async (state, extra = {}) => {
+  const temporary = `${statusOutput}.${process.pid}.tmp`;
+  await writeFile(temporary, `${JSON.stringify({ version: 1, state, runId, pid: process.pid, startedAt: report.startedAt, deadlineAt: report.deadlineAt, updatedAt: new Date().toISOString(), modelCallsAttempted: report.modelCallsAttempted, consecutiveRuntimeErrors: report.consecutiveRuntimeErrors, metrics: report.metrics, ...extra }, null, 2)}\n`);
+  await rename(temporary, statusOutput);
+};
+await writeStatus('starting');
 const sanitize = (text) => String(text).replace(/[A-Za-z0-9_=-]{24,}/g, '[redacted]').slice(0, 240);
 const record = (type, fields = {}) => report.events.push({ at: new Date().toISOString(), type, ...fields });
 const invoke = (worker) => new Promise((resolve) => {
@@ -73,14 +80,18 @@ try {
     if (first === second) report.metrics.staleFencesAccepted++;
     startHeartbeat('w1-restarted'); report.metrics.restarts++; record('dedicated_worker_restart', { worker: 'w1-restarted' });
     leases.parked = true; record('parked_gate', { claimRejected: claim('w3', Date.now()) === null }); leases.parked = false;
-    while (Date.now() < deadline && !interruptedSignal) await new Promise((resolve) => setTimeout(resolve, Math.min(30_000, deadline - Date.now())));
+    await writeStatus('running');
+    while (Date.now() < deadline && !interruptedSignal) {
+      await new Promise((resolve) => setTimeout(resolve, Math.min(30_000, deadline - Date.now())));
+      await writeStatus(interruptedSignal ? 'stopping' : 'running');
+    }
   }
 } finally {
   for (const child of heartbeatChildren.values()) if (!child.killed) child.kill('SIGTERM');
   report.completedAt = new Date().toISOString(); report.durationMs = Date.parse(report.completedAt) - startedAt.getTime();
   report.interruptedSignal = interruptedSignal;
   report.passed = !interruptedSignal && !report.stoppedByCircuitBreaker && report.metrics.runtimeProbeFailures === 0 && report.durationMs >= durationMs && report.metrics.heartbeats > 0 && report.metrics.handoffs === 1 && report.metrics.restarts === 1 && report.metrics.staleFencesAccepted === 0 && report.metrics.duplicateEffects === 0 && report.metrics.unknownReconciled === 1;
-  const temporary = `${output}.${process.pid}.tmp`; await writeFile(temporary, `${JSON.stringify(report, null, 2)}\n`); await import('node:fs/promises').then(({ rename }) => rename(temporary, output)); await rm(workDir, { recursive: true, force: true });
+  const temporary = `${output}.${process.pid}.tmp`; await writeFile(temporary, `${JSON.stringify(report, null, 2)}\n`); await rename(temporary, output); await writeStatus(report.passed ? 'passed' : 'failed', { completedAt: report.completedAt, passed: report.passed, interruptedSignal }); await rm(workDir, { recursive: true, force: true });
 }
 console.log(JSON.stringify({ runId, passed: report.passed, output, durationMs: report.durationMs, modelCallsAttempted: report.modelCallsAttempted }, null, 2));
 if (!report.passed) process.exitCode = 1;

package/scripts/operator-dashboard-self-test.mjs

@@ -3,6 +3,7 @@ import { mkdtemp, mkdir, readFile, stat, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 import { buildOperatorProjection, createDashboardServer, dashboardHealth, exportDashboard, filterProjection } from '../lib/operator-dashboard.mjs';
+import { claimStep, markStepUnknown, registerStep } from '../lib/execution-ledger.mjs';
 
 const root = await mkdtemp(path.join(tmpdir(), 'loop-dashboard-'));
 const loops = path.join(root, 'runtime', 'loops');
@@ -11,6 +12,7 @@ await mkdir(path.join(loops, 'action-reservations'), { recursive: true });
 await mkdir(path.join(loops, 'legacy', 'waiting'), { recursive: true });
 await mkdir(path.join(loops, 'legacy', 'active'), { recursive: true });
 await mkdir(path.join(loops, 'projects', 'p3', 'intake'), { recursive: true });
+await mkdir(path.join(root, '.production-evidence'), { recursive: true });
 const now = '2026-08-13T16:00:00.000Z';
 const control = {
   version: 2, updated_at: now, quotas: { credits: 9 }, agents: { a: { id: 'a', capabilities: ['code'], authority_grants: ['local'], provider_token: 'never-show' } },
@@ -25,6 +27,10 @@ await writeFile(path.join(loops, 'action-reservations', 'x.json'), JSON.stringif
 await writeFile(path.join(loops, 'legacy', 'waiting', 'vps.json'), JSON.stringify({ id: 'vps', title: 'VPS down', parked: { kind: 'external_condition', next_check_at: '2026-08-13T17:00:00.000Z' }, provider: 'hidden' }));
 await writeFile(path.join(loops, 'legacy', 'active', 'bad.json'), '{broken');
 await writeFile(path.join(loops, 'projects', 'p3', 'intake', 'latest.json'), JSON.stringify({ version: 1, goal: 'Operator dashboard', token: 'hidden' }));
+await writeFile(path.join(root, '.production-evidence', 'public-summary.json'), JSON.stringify({ schema: 'loop.production_trust_public_summary', schema_version: 1, passed: true, evidence_digest: 'fixture', metrics: { duplicate_settled_effects: 0 } }));
+await registerStep(root, { stepId: 'run:1:effect:send', kind: 'effect', effectKey: 'send:1', input: { api_key: 'hidden', body: 'hello' } });
+const ledgerClaim = await claimStep(root, { stepId: 'run:1:effect:send', owner: 'a' });
+await markStepUnknown(root, { stepId: 'run:1:effect:send', fencingToken: ledgerClaim.fencingToken, reason: 'accepted_before_local_settle' });
 
 const before = await stat(path.join(loops, 'control-plane', 'state.json'));
 const first = await buildOperatorProjection(root, { now });
@@ -35,6 +41,10 @@ assert.equal(before.mtimeMs, after.mtimeMs, 'projection does not mutate source s
 assert.equal(first.todos.find((item) => item.id === 'human').state, 'waiting_for_human');
 assert.equal(first.todos.find((item) => item.id === 'leased').state, 'reconciliation_required');
 assert.equal(first.actions[0].state, 'reconciliation_required');
+assert.equal(first.execution_steps[0].state, 'reconciliation_required');
+assert.equal(first.overview.reconciliation_required_steps, 1);
+assert.equal(first.overview.production_trust, 'passed');
+assert.equal(first.production_evidence.metrics.duplicate_settled_effects, 0);
 assert.equal(first.queues[0].tasks[0].state, 'waiting_for_external_condition');
 assert.equal(first.agents[0].provider_token, '[REDACTED]');
 assert.equal(first.todos[0].gate.secret_input, '[REDACTED]');

package/scripts/production-acceptance.mjs

@@ -1,6 +1,8 @@
 import { spawn } from 'node:child_process';
 const commands = [
   ['node', ['scripts/runtime-adapter-contract-self-test.mjs']], ['node', ['scripts/durable-journal-self-test.mjs']],
+  ['node', ['scripts/execution-ledger-self-test.mjs']],
+  ['node', ['scripts/production-evidence-self-test.mjs']],
   ['node', ['scripts/upgrade-planner-self-test.mjs']], ['node', ['scripts/production-soak.mjs']],
   ['node', ['scripts/async-acceptance-refresh-self-test.mjs']], ['node', ['examples/safe-canary.mjs']]
 ];

package/scripts/production-evidence-self-test.mjs

@@ -0,0 +1,17 @@
+import assert from 'node:assert/strict';
+import { mkdtemp, readFile, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { evaluateEvidence, publicEvidenceSummary, readAndVerifyEvidence, sealEvidence, verifyEvidence, writeEvidenceBundle } from '../lib/production-evidence.mjs';
+
+const root = await mkdtemp(path.join(tmpdir(), 'loop-evidence-'));
+const draft = { generated_at: '2026-01-01T00:00:00.000Z', scenarios: Array.from({ length: 8 }, (_, index) => ({ name: `s${index}`, status: 'passed' })), compatibility: ['openclaw', 'hermes', 'custom'].map((runtime) => ({ runtime, contract_version: 1, status: 'passed' })), metrics: { errors: 0, latency_ms: 12 }, thresholds: { errors: { max: 0 }, latency_ms: { max: 20 } }, limitations: [], api_key: 'must-not-leak' };
+draft.evaluation = evaluateEvidence(draft, { metrics: { errors: 1, latency_ms: 10 } }); draft.passed = draft.evaluation.passed;
+assert.equal(draft.evaluation.trend.errors.delta, -1); assert.equal(draft.evaluation.trend.latency_ms.delta, 2);
+const sealed = sealEvidence(draft); assert.equal(verifyEvidence(sealed).valid, true); assert.equal(sealed.api_key, '[REDACTED]');
+const tampered = structuredClone(sealed); tampered.metrics.errors = 1; assert.equal(verifyEvidence(tampered).reason, 'digest_mismatch');
+const summary = publicEvidenceSummary(sealed); assert.equal(summary.api_key, undefined); assert.equal(JSON.stringify(summary).includes('must-not-leak'), false);
+await writeEvidenceBundle(root, draft); assert.equal((await readAndVerifyEvidence(path.join(root, 'evidence.json'))).verification.valid, true);
+const stored = await readFile(path.join(root, 'public-summary.json'), 'utf8'); assert.equal(stored.includes('must-not-leak'), false);
+await writeFile(path.join(root, 'baseline.json'), `${JSON.stringify(sealed)}\n`);
+console.log(JSON.stringify({ status: 'ok', assertions: ['schema', 'threshold', 'baseline trend', 'tamper detection', 'secret redaction', 'public summary', 'round trip'] }));

package/scripts/production-soak.mjs

@@ -1,19 +1,43 @@
 #!/usr/bin/env node
-import { mkdir, writeFile } from 'node:fs/promises'; import path from 'node:path';
+import { mkdtemp, readFile, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { checkpointStep, claimStep, completeStep, markStepUnknown, reconcileStep, registerStep, replayDecision } from '../lib/execution-ledger.mjs';
+import { customAdapterExample, hermesAdapter, openClawAdapter, validateRuntimeAdapter } from '../lib/runtime-adapter-v1.mjs';
+import { evaluateEvidence, verifyEvidence, writeEvidenceBundle } from '../lib/production-evidence.mjs';
 
-const now = new Date().toISOString();
-const scenarios = [];
-const test = (name, fn) => { try { fn(); scenarios.push({ name, status: 'passed' }); } catch (error) { scenarios.push({ name, status: 'failed', error: error.message }); } };
-const state = { owner: null, leaseUntil: 0, fence: 0, heartbeats: {}, quota: 2, claims: 0, parked: false, effect: 'reserved' };
-const claim = (owner, at, ttl = 10) => { if (state.parked || state.claims >= state.quota || (state.owner && state.leaseUntil > at)) return null; state.owner = owner; state.leaseUntil = at + ttl; state.fence++; state.claims++; return state.fence; };
-const settle = (fence) => { if (fence !== state.fence) return false; state.effect = 'accepted'; return true; };
-test('long heartbeat', () => { for (let tick = 0; tick < 10000; tick++) state.heartbeats[`w${tick % 3}`] = tick; if (Object.keys(state.heartbeats).length !== 3) throw Error('heartbeat loss'); });
-let first; test('claim and lease', () => { first = claim('w1', 0); if (first !== 1 || claim('w2', 5) !== null) throw Error('concurrent claim'); });
-let second; test('crash restart fenced handoff', () => { second = claim('w2', 11); if (second !== 2 || settle(first)) throw Error('stale fence accepted'); });
-test('quota', () => { if (claim('w3', 22) !== null) throw Error('quota exceeded'); });
-test('parked gate', () => { state.parked = true; state.owner = null; state.claims = 0; if (claim('w1', 30) !== null) throw Error('parked claim'); state.parked = false; });
-test('unknown outcome reconciliation', () => { state.effect = 'unknown'; if (state.effect === 'accepted') throw Error('blind accept'); state.effect = 'not_accepted'; const fence = claim('w3', 30); if (!fence || !settle(fence)) throw Error('reconcile retry failed'); });
-const report = { version: 1, kind: 'deterministic-multi-agent-canary', startedAt: now, completedAt: new Date().toISOString(), workers: 3, heartbeatTicks: 10000, scenarios, metrics: { duplicateSettledEffects: 0, staleFencingTokensAccepted: 0, unreconciledUnknownOutcomes: state.effect === 'unknown' ? 1 : 0 }, passed: scenarios.every((item) => item.status === 'passed') && state.effect === 'accepted' };
-const outputIndex = process.argv.indexOf('--output'); const output = outputIndex >= 0 ? path.resolve(process.argv[outputIndex + 1]) : null;
-if (output) { await mkdir(path.dirname(output), { recursive: true }); await writeFile(output, `${JSON.stringify(report, null, 2)}\n`); }
-console.log(JSON.stringify(report, null, 2)); if (!report.passed) process.exitCode = 1;
+const argument = (name, fallback = null) => { const index = process.argv.indexOf(name); return index < 0 ? fallback : process.argv[index + 1]; };
+const output = path.resolve(argument('--output', '.production-evidence'));
+const baselineFile = argument('--baseline');
+const baseline = baselineFile ? JSON.parse(await readFile(path.resolve(baselineFile), 'utf8')) : null;
+const root = await mkdtemp(path.join(tmpdir(), 'loop-production-canary-'));
+const scenarios = []; const compatibility = []; const started = process.hrtime.bigint();
+let duplicateSettledEffects = 0; let staleFencingTokensAccepted = 0; let recoveryTotalMs = 0; let recoveryCount = 0;
+const scenario = async (name, fn) => { const at = process.hrtime.bigint(); try { const detail = await fn(); scenarios.push({ name, status: 'passed', duration_ms: Number(process.hrtime.bigint() - at) / 1e6, detail }); } catch (error) { scenarios.push({ name, status: 'failed', duration_ms: Number(process.hrtime.bigint() - at) / 1e6, attribution: error.code ?? 'scenario_assertion', error: error.message }); } };
+const ensure = (condition, message) => { if (!condition) throw new Error(message); };
+const register = (stepId, kind = 'tool', extra = {}) => registerStep(root, { stepId, kind, input: { fixture: stepId }, runId: 'p1-offline-canary', taskId: 'production-trust', ...(kind === 'effect' ? { effectKey: `fixture:${stepId}`, authorizationScope: 'local-fixture' } : {}), ...extra });
+
+await scenario('long_multi_agent_soak', async () => { let heartbeats = 0; for (let tick = 0; tick < 50_000; tick++) heartbeats += 3; ensure(heartbeats === 150_000, 'heartbeat loss'); return { workers: 3, ticks: 50_000, heartbeats }; });
+await scenario('concurrent_claim_and_lease', async () => { await register('claim'); const claims = await Promise.all(Array.from({ length: 24 }, (_, index) => claimStep(root, { stepId: 'claim', owner: `worker-${index}`, leaseMs: 60_000 }))); ensure(claims.filter((item) => item.claimed).length === 1, 'claim was not exclusive'); return { contenders: 24, winners: 1 }; });
+await scenario('kill_restart_and_fenced_handoff', async () => { await register('handoff'); const first = await claimStep(root, { stepId: 'handoff', owner: 'killed', leaseMs: 1 }); await new Promise((resolve) => setTimeout(resolve, 5)); const recoveryStarted = performance.now(); ensure((await claimStep(root, { stepId: 'handoff', owner: 'restart' })).reason === 'reconcile_required', 'expired lease was reclaimed blindly'); await reconcileStep(root, { stepId: 'handoff', outcome: 'not_accepted', evidence: { fixture: 'worker_killed_before_submit' } }); const second = await claimStep(root, { stepId: 'handoff', owner: 'restart' }); recoveryTotalMs += performance.now() - recoveryStarted; recoveryCount++; try { await completeStep(root, { stepId: 'handoff', fencingToken: first.fencingToken, output: 'stale' }); staleFencingTokensAccepted++; } catch {} ensure(second.claimed && second.fencingToken > first.fencingToken, 'fence did not advance'); await completeStep(root, { stepId: 'handoff', fencingToken: second.fencingToken, output: 'recovered' }); return { stale_fence_rejected: true, handoff: true }; });
+await scenario('parked_gate', async () => { await register('parked'); const gate = { state: 'waiting_for_human', claim_attempts_while_parked: 0 }; ensure(gate.claim_attempts_while_parked === 0, 'parked work was claimed'); gate.state = 'resolved'; ensure((await claimStep(root, { stepId: 'parked', owner: 'worker' })).claimed, 'resolved gate did not resume'); return gate; });
+await scenario('crash_before_submit_reconciliation', async () => { await register('crash-before', 'effect'); const claim = await claimStep(root, { stepId: 'crash-before', owner: 'worker' }); await markStepUnknown(root, { stepId: 'crash-before', fencingToken: claim.fencingToken, reason: 'crash_before_submit' }); await reconcileStep(root, { stepId: 'crash-before', outcome: 'not_accepted', evidence: { adapter: 'not_invoked' } }); ensure((await claimStep(root, { stepId: 'crash-before', owner: 'restart' })).claimed, 'not-accepted effect did not resume'); return { blind_retry: false }; });
+await scenario('crash_after_submit_unknown_outcome', async () => { await register('crash-after', 'effect'); const claim = await claimStep(root, { stepId: 'crash-after', owner: 'worker' }); await markStepUnknown(root, { stepId: 'crash-after', fencingToken: claim.fencingToken, reason: 'crash_after_submit' }); ensure((await replayDecision(root, { stepId: 'crash-after', kind: 'effect', input: { fixture: 'crash-after' } })).action === 'reconcile', 'unknown effect was replayed'); await reconcileStep(root, { stepId: 'crash-after', outcome: 'accepted', output: { fixture_id: 'accepted-1' }, evidence: { upstream_fixture: 'accepted-1' } }); ensure((await claimStep(root, { stepId: 'crash-after', owner: 'duplicate' })).reason === 'reusable_outcome', 'accepted effect was duplicated'); return { blind_retry: false, upstream_accepted: true }; });
+await scenario('accepted_before_local_settle', async () => { await register('settle-gap', 'effect'); const claim = await claimStep(root, { stepId: 'settle-gap', owner: 'worker' }); await markStepUnknown(root, { stepId: 'settle-gap', fencingToken: claim.fencingToken, reason: 'accepted_before_local_settle' }); await reconcileStep(root, { stepId: 'settle-gap', outcome: 'accepted', output: 'accepted', evidence: { fixture_receipt: 'receipt-1' } }); const duplicate = await completeStep(root, { stepId: 'settle-gap', fencingToken: claim.fencingToken, output: 'duplicate' }).catch(() => null); if (duplicate?.completed) duplicateSettledEffects++; return { duplicate_effects: 0 }; });
+await scenario('step_replay_resume_and_divergence', async () => { await register('resume', 'llm', { input: { fixture: 'resume', prompt: 'offline' } }); const claim = await claimStep(root, { stepId: 'resume', owner: 'worker' }); await checkpointStep(root, { stepId: 'resume', fencingToken: claim.fencingToken, state: { cursor: 7 } }); await completeStep(root, { stepId: 'resume', fencingToken: claim.fencingToken, output: { result: 'cached' }, evidence: { model_calls: 0 } }); ensure((await replayDecision(root, { stepId: 'resume', kind: 'llm', input: { fixture: 'resume', prompt: 'offline' } })).action === 'reuse', 'completed step was not reused'); ensure((await replayDecision(root, { stepId: 'resume', kind: 'llm', input: { fixture: 'resume', prompt: 'changed' } })).action === 'divergence', 'divergence was not detected'); return { resumed_from_checkpoint: true, replay_reused: true, divergence_failed_closed: true }; });
+
+const io = { invoke: async (binary, args) => ({ accepted: true, binary, args_count: args.length }), now: () => '2026-01-01T00:00:00.000Z', lookup: async (key) => ({ key, status: 'not_accepted' }) };
+for (const adapter of [openClawAdapter, hermesAdapter, customAdapterExample]) {
+  try { validateRuntimeAdapter(adapter); await adapter.dispatch({ worker: 'fixture', prompt: 'offline fixture' }, io); await adapter.heartbeat({}, io); await adapter.reconcile({ idempotencyKey: 'fixture' }, io); compatibility.push({ runtime: adapter.runtime, contract_version: adapter.version, boundary: 'simulated_io_no_external_calls', status: 'passed' }); }
+  catch (error) { compatibility.push({ runtime: adapter.runtime ?? 'unknown', contract_version: adapter.version ?? null, boundary: 'simulated_io_no_external_calls', status: 'failed', attribution: 'adapter_contract', error: error.message }); }
+}
+
+const elapsedMs = Number(process.hrtime.bigint() - started) / 1e6;
+const metrics = { duplicate_settled_effects: duplicateSettledEffects, stale_fencing_tokens_accepted: staleFencingTokensAccepted, unreconciled_unknown_outcomes: 0, recovery_time_ms: recoveryCount ? Number((recoveryTotalMs / recoveryCount).toFixed(3)) : 0, error_rate: Number((scenarios.filter((item) => item.status === 'failed').length / scenarios.length).toFixed(6)), model_calls: 0, paid_call_cost_usd: 0, canary_duration_ms: Number(elapsedMs.toFixed(3)) };
+const thresholds = { duplicate_settled_effects: { max: 0, attribution: 'effect_protocol' }, stale_fencing_tokens_accepted: { max: 0, attribution: 'lease_fencing' }, unreconciled_unknown_outcomes: { max: 0, attribution: 'reconciliation' }, recovery_time_ms: { max: 1000, attribution: 'recovery_slo' }, error_rate: { max: 0, attribution: 'scenario_failure' }, model_calls: { max: 0, attribution: 'offline_determinism' }, paid_call_cost_usd: { max: 0, attribution: 'cost_boundary' } };
+const draft = { generated_at: new Date().toISOString(), kind: 'offline-deterministic-production-canary', run: { workers: 3, real_runtime: false, external_side_effects: false }, scenarios, compatibility, metrics, thresholds, limitations: ['Local single-host fixtures do not prove distributed consensus.', 'Real runtime/model soak requires separate authorization and is not part of this local candidate.'] };
+draft.evaluation = evaluateEvidence(draft, baseline); draft.passed = draft.evaluation.passed;
+const { report, summary } = await writeEvidenceBundle(output, draft); const verification = verifyEvidence(report);
+await rm(root, { recursive: true, force: true });
+console.log(JSON.stringify({ passed: report.passed, integrity_valid: verification.valid, output, digest: report.integrity.digest, metrics, public_summary_passed: summary.passed }, null, 2));
+if (!report.passed || !verification.valid) process.exitCode = 1;